diff --git a/.gitignore b/.gitignore
index ef42f3d5..d74fb8a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,10 +25,10 @@ coverage/
 credentials*.json
 service-account*.json
 
-# Legacy uploaded session assets (Replit-era; superseded by object storage)
+# Legacy uploaded session assets (superseded by object storage)
 attached_assets/
 
-# Replit platform & agent infrastructure (kept locally, never in git)
+# Hosted-platform configs and agent state (kept locally, never in git)
 .replit
 .replitignore
 replit.nix
diff --git a/README.md b/README.md
index 673ba208..af15b1c0 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ $EDITOR .env
 
 docker compose build
 docker compose up -d db minio minio-init
-docker compose run --rm migrate          # one-shot: db push + seed
+docker compose run --rm migrate          # one-shot: pnpm run migrate (db push + seed)
 docker compose up -d api web
 ```
 
diff --git a/artifacts/api-server/package.json b/artifacts/api-server/package.json
index db51cd90..9cd33ec1 100644
--- a/artifacts/api-server/package.json
+++ b/artifacts/api-server/package.json
@@ -9,7 +9,8 @@
     "start": "node --enable-source-maps ./dist/index.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test:wait": "node ./scripts/wait-for-server.mjs",
-    "test": "node --test 'tests/**/*.test.mjs'"
+    "test": "node --test 'tests/**/*.test.mjs'",
+    "migrate": "pnpm --filter @workspace/db run push && pnpm --filter scripts run seed"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.658.0",
diff --git a/docker-compose.yml b/docker-compose.yml
index ba5efc74..e75a876f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -162,6 +162,8 @@ services:
       NODE_ENV: production
       SEED_ADMIN_PASSWORD: ${SEED_ADMIN_PASSWORD}
       SEED_USER_PASSWORD: ${SEED_USER_PASSWORD}
+    # Single canonical entrypoint — wraps `pnpm --filter db push` + seed.
+    command: ["pnpm", "--filter", "@workspace/api-server", "run", "migrate"]
     networks: [internal]
 
 volumes: